As a method for detecting a failure of a memory or a sensor, a majority method is known. Specifically, this method is a method by which the outputs of three memories or sensors are compared with each other, and, when two of three outputs match, two memories or sensors are judged to be normal, and the remaining one is judged to have broken down.
However, when two of three memories or sensors are broken down, sometimes the two broken memories or sensors may be judged to be normal by the majority method. In such a case, failure diagnosis cannot be carried out accurately.
Moreover, when failure diagnosis is carried out on three objects by the majority method, if one of these objects is judged to have broken down, it becomes impossible to carry out failure diagnosis by the majority method by using the remaining two objects. This immediately leads to a system halt. Therefore, when one object is judged to have broken down by failure detection, the objects of diagnosis have to be changed. This makes it impossible to guarantee the system during operation.